NIST SP 800-82

1. 2026-09-21 Medium
   NIST publishes SP 800-82 Revision 4 Initial Public Draft for Operational Technology Security

   NIST has released the Initial Public Draft of SP 800-82 Revision 4 for public comment and feedback. This update to the Guide to Operational Technology (OT) …

   New version Action required

1. 2026-11-30 in 21 days Comment deadline for the initial public draft of SP 800-82 Rev. 4
2. 2026-09-21 SP 800-82 Rev. 4 initial public draft published
3. 2026-01-22 NIST opens the revision of SP 800-82 with a call for comments
4. 2023-09-28 SP 800-82 Rev. 3 published; Rev. 2 withdrawn

1. 2026-09-21
   SP 800-82 Rev. 4 (initial public draft) Draft

   Draft fourth revision. source

   More

   • It covers more OT sectors (building automation, water and wastewater, food and agriculture, freight rail, maritime vessels, industrial IoT and cloud convergence) and is restructured around NIST CSF 2.0 with a focus on the Govern function.
   • It adds alignment with enterprise risk management (NIST IR 8286r1), RMF adoption guidance, more on asset management and network monitoring, and zero trust architecture guidance.
   • Comments are due by 30 November 2026.
2. 2023-09-28
   SP 800-82 Rev. 3 Major versionCurrent

   Retitled "Guide to Operational Technology (OT) Security": scope widened from industrial control systems to all OT, with updated threats, vulnerabilities, risk management, architectures and security tools. source

   More

   • It added alignment with the CSF, tailoring guidance for SP 800-53 Rev. 5 and an OT overlay with low, moderate and high baselines.
3. 2015-06-03
   SP 800-82 Rev. 2 Revision source

   Not confirmed by an official source yet.

4. 2013-05-14
   SP 800-82 Rev. 1 Revision source

   Not confirmed by an official source yet.

5. 2011-06-09
   SP 800-82 Major version

   First edition, "Guide to Industrial Control Systems (ICS) Security". source

SP 800-82 provides guidance on how to secure operational technology (OT) while addressing its unique performance, reliability and safety requirements.

What it covers

SP 800-82 provides guidance on how to secure operational technology (OT) while addressing its unique performance, reliability and safety requirements. source

Federal agencies

For federal agencies, Rev. 3 provides an OT overlay that tailors the SP 800-53 Rev. 5 low, moderate and high baselines to OT systems. source

Other organizations

Nongovernmental organizations may use it voluntarily. source

Rev. 3 applies the Risk Management Framework to OT systems, with an overlay that tailors the SP 800-53 controls.

Risk Management Framework

Rev. 3 applies the Risk Management Framework to OT systems, and its overlay tailors the SP 800-53 Rev. 5 control baselines. source

Rev. 4 draft

Rev. 4 draft adds a discussion of adopting the RMF for OT (Appendix F). source

NIST is not a regulatory agency.

Not a regulator

NIST is not a regulatory agency. source

1. Standard NIST SP 800-82 Rev. 3 – Guide to Operational Technology (OT) Security (PDF)
2. Standard NIST SP 800-82 Rev. 4 initial public draft (PDF)
3. Guidance SP 800-82 Rev. 4 draft – publication page and comment template

1. IEC 62443

   IEC 62443 is the international, certifiable standard series for industrial automation security; SP 800-82 is free US guidance that maps to such standards.

2. NIST SP 800-53

   SP 800-53 is the general control catalog; SP 800-82 Rev. 3 adds an OT overlay that tailors its baselines for OT systems.

3. NERC CIP

   NERC CIP is a mandatory, enforceable reliability standard for the North American bulk electric system; SP 800-82 is voluntary cross-sector OT guidance.

4. NIST CSF

   The CSF sets organization-wide outcomes; the Rev. 4 draft of SP 800-82 is restructured around CSF 2.0 for OT environments.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to NIST SP 800-82 (RSS)